RESURGE Webshell Parameter Detected

Ethan Andrews@eandrews

•updated Feb 27, 2026•2•0•39

Detects HTTP requests to the 'compcheckresult.cgi' script containing the unique parameter 'vXm8DtMJG'. This pattern is a strong indicator of the RESURGE webshell, which is injected into the CGI script on compromised Ivanti Connect Secure devices to allow for remote command execution.